TechNewsWorld, CA - Feb 2, 2007
Aiming to improve security in its new operating system,
Microsoft has endowed Vista's kernel with highly restricted
access, locking out hackers and malware purveyors. It
may have locked out other security software as well.
That's not good, say competing manufacturers, who say
Vista's security system alone is not enough.
With the first shipments of the new Microsoft (Nasdaq:
MSFT) Vista operating system still lingering on store
shelves, many consumers may not yet be sure whether
Vista's much ballyhooed security enhancements will make
them less vulnerable to virus, adware and spyware infections.
Microsoft claims its restricted access to the operating
system's kernel will lock out hackers and malware purveyors.
However, some security experts and third-party antivirus
vendors claim that the only thing Microsoft has locked
out of its new operating system is competing security
products. These vendors worry that consumers, who often
are the weak link in maintaining adequate computer security,
will be lulled into complacency, believing that Vista
will make other security efforts unnecessary.
"We have concerns about Vista and security. We've
been following Vista for the last year. What Microsoft
wanted to do was block everything -- good or bad --
at the kernel level," Sanjay Pradhan, CEO of Max
Secure Software, told TechNewsWorld. "But this
is a flawed view. You think you can block everybody
out. Hackers have already started finding ways to get
in. Microsoft's products are scoring on the low end
of the market. It's not very good."
Security will remain an issue with Vista, agrees Andy
Vandamia, director of software marketing for computer
security firm AuthenTec . However, Vandamia does not
see Vista's built-in security products having an adverse
impact on third-party security vendors.
"While Microsoft has made major progress in improving
overall security in Vista, it does not provide a complete
secure computing environment," Vandamia said. "The
bulk of Microsoft's Vista security improvements are
based on the assumption that the computer is physically
secure. Portable computing platforms are designed to
move freely between physically safe corporate computing
areas and completely unsafe and very public locations."
Weakness Found
Computer security firm Webroot Software reported on
Jan. 25 that its testing revealed significant holes
in Vista's security shields. According to Webroot, its
tests on Vista's security showed it to have ineffective
blocking capabilities and weak antivirus capabilities
in the default anti-spyware and antivirus components
within the new operating system. Problems were also
found in Microsoft's Live OneCare security suite.
For instance, Webroot said Windows Defender failed
to block 84 percent of a testing sample set that included
15 of the most common variations of existing spyware
and malware. Also, Windows Defender did not perform
at the level of many third-party security applications
.
Webroot said that Microsoft Vista permitted a variety
of threats, including adware, potentially unwanted programs
(PUPs), system monitors, key loggers and Trojans, to
reside on the testing environment undetected.
Microsoft's additional charge to Vista users for antivirus
protection through a subscription, is a potential weakness
in security. Consumers may be unwilling to make that
purchase.
Blocking Strategy
Microsoft's attempts to block out third-party vendors
raises fairness questions, according to Max Secure's
Pradhan. However, he believes that strategy will be
short-lived.
"Microsoft should have learned that approach is
not the best way to go. I see Microsoft changing because
consumers will see that they do have a choice,"
he said. "Microsoft is offering a system that is
flawed. Consumers will force Microsoft to open up the
kernel access when infections and attacks continue."
Marco Peretti, CEO of BeyondTrust, does not see Microsoft's
decision to lock down access to the Vista kernel all
that detrimental. He said Microsoft has made accessing
the the kernel in the 32-bit version of Vista more difficult
than in Windows XP.
"Microsoft is blocking the kernel only on 64-bit,
not the 32-bit, platforms. To Microsoft the 64-bit Vista
is the future," Peretti noted, adding that 2007
and 2008 will see the mainstream adoption of the 64-bit
Vista operating system.
Lockdown Issue
The problem comes with Vista 64-bit, which utilizes
patch-guard, according to John Safa, security expert
and the chief architect at DriveSentry. This prevents
programs patching the key system functions, which are
used by hackers to create rootkits.
These same functions are also patched by security vendors
to detect threats, which they are now unable to do,
Safa claimed. Microsoft has said that it intends to
provide access to security vendors of Vista 64-bit by
the time it releases Service Pack 1 for Vista. This
could be some time away.
The fault for not developing strategies for dealing
with Vista's 32-bit compatibility issues lies with third-party
vendors, Safa contended.
Still, third-party security vendors are adapting their
products to work with the kernel restrictions in the
32-bit OS version.
"There is no real reason why security vendors
cannot have their product ready for Vista 32-bit,"
he said.
Not All Bad
Microsoft's new kernel approach is an improvement
of sorts, according to Larry Biddell, vice president
of Global Securities Strategies at Grisoft. Any time
an OS maker wants to make a more secure system, it's
a good thing, he said.
"Locking down the kernel is a good thing if it
makes the kernel more secure than previous OS versions.
But this doesn't mean the new OS will be totally secure,"
Biddell added.
He is not all that concerned about Microsoft entering
into the security products space as a competitor. Since
consumers and enterprise users always need more security
layers, third-party products are not going to go away
because of Vista, he predicted.
However, Biddell expects Microsoft to have some perception
issues to overcome before customers will fully trust
the built-in security measures in Vista.
"Vista-based security won't chase competitors
away. This is not going to be the end of the road for
us, just as Microsoft's introduction of the proxy server/firewall
feature in Windows XP didn't chase away third-party
vendors," Biddell explained.
Hacker Challenge
Safa views Microsoft's claim that it has locked down
Vista as tantamount to issuing an open invitation to
the hacking community to prove it wrong.
"There's real money to be made in this high stakes
game, and the rules have completely changed," Safa
noted. "Today's malware threat has evolved into
a destructive force that outpaces even the best antivirus
signatures, leaving consumers' personal data completely
exposed to zero-day attacks."
The real issue is that individuals must start approaching
security at the data level. They have to use products
that will isolate malware before it can wreak havoc
on their PCs, Safa concluded.
|
